¢£Specialties

The main theme is formal verication, from theory to application. Main methodology is theorem proving and model checking, applied to program anayses and security protocol verifications. Theoretical research covers efficient algorithms based on combinatorics, non-linear term rewriting systems, decidability issues in formal languages.

¢£Research Keywords

¢£Research Interests

Context-sensitive analyses for Large-scale Java programsThe aim of the research is to design and implement various contex-sensitive analyses of large-scale Java programs (say, 10000 methods) based on weighted pushdown model checking. The main focus is a context-sensitive and flow insensitive points-to analysis, and we proposed a new algorithm based on weighted pushdown model checking. Its implementation is ongoing with SOOT (translation to an intermediate language Jimple) as a frontend anf Weighted PDS library as a backend analysis engine.Confluence of non-left-linear term rewriting systemsConfluence ans termination are basic properties of term rewriting systems (TRSs). When termination holds, Knuth and Bendix showed in 1970s that local confluence of critical pairs is enough for confluence. For nonterminationg TRSs, Rosen showed the orthogonality (i.e., left-linear and nonoverlapping) implies confluence in 1960's and Huet extended it to left-linear and prallel closed TRSs in 1980. For non-left-linear and non-terminating TRSs, Chew showed the unique normal form for strongly nonoverlapping TRSs. Toyama and Oyamaguchi conjectured that strongly nonoverlapping and right-linear TRSs are confluent in 1990, which is still an open problem. Many attempts based on decreasing diagrams failed so far, and we are tackling with a new proof techniques, called reduction graphs. Our current resutl is, a strongly nonoverlapping and weakly shallow TRS is confluentBinary code analyzer BE-PUM for malwareProgram analysis consists of two steps: model generation and model checking. For high level programming languages, such as C, Java, mthe former is straight forward by generating a contol flow graph (CFG). However, binary code, especially malware, it is not easy, since it does not distinguish code and data, and there are lots of obfuscation techniques, e.g., self modification and indirect jump. With the collaboration with VNU-HCMC, we have developped a model generater BE-PUM based on dynamic symbolic execution in an on-the-fly manner. It also works as a robust disassebler, and even as a general unpacker for packed code by many packers.Well-structured pushdown systemsDecidability of infinite state transition systems has been explored in two directions: a well-structured transition system (WSTS), e.g., petri net, proposed by Finkl, et.al. on 1987, and a pushdown system, which has a stack. The key is a well-quasi ordering equiped for inifnite states. A well-structured pushdown system (WSPDS) combines both still keeping decidability. We showed the decidablity of the coverability if a WSTS has finite control states (and well-quasi-ordered stack alphabet), by using P-automata techniques, which reduced the coverability of a WSPDS into that of a WSTS (P-automaton). Our techniques cover many existing decidability resutls, e.g., braching VAS, recursive VASS, alternating VASS, multiset PDS. We also applied to variations of timed pushdown systems, nested timed automata (NeTA) with frozen clocks. A NeTA has finitely many timed automata as its control states and its stack alphabet. We showed the decidability of its reachability if it has at most one global clock.raSAT: SMT solver for nonlinear constraintsAn SMT solver solves the satisfiability of quantifier-free constraints. It has many variations of backend theory, e.g. linear arithmetic, uninterpreted function symbols, arrays. They are quite established theories, but non-linear artihmetic (polynomials) are still under investigation. The ultimate method is based on computer algebra, however, it does not scale. We take an alternative apractical approach based on interval arithmetic and the intermediate value theorem. Our idea is implemented as the tool raSAT, which has participated the internation SMT solver competition SMT-COMP 2015. It obtained 3rd among 6 tools in QFNRA category (nonlinear constraint over reals) and 2nd among 7 tools in QFNIA category (nonlinear constraint over integers).raSAT: SMT solver for nonlinear constraintsAn SMT solver solves the satisfiability of quantifier-free constraints. It has many variations of backend theory, e.g. linear arithmetic, uninterpreted function symbols, arrays. They are quite established theories, but non-linear artihmetic (polynomials) are still under investigation. The ultimate method is based on computer algebra, however, it does not scale. We take an alternative apractical approach based on interval arithmetic and the intermediate value theorem. Our idea is implemented as the tool raSAT, which has participated the internation SMT solver competition SMT-COMP 2015. It obtained 3rd among 6 tools in QFNRA category (nonlinear constraint over reals) and 2nd among 7 tools in QFNIA category (nonlinear constraint over integers).